CVE-2015-6926 OXID eShop user impersonation vulnerability
Remote attackers can impersonate users in OXID eShop by exploiting a flaw in OpenID Single Sign-On authentication token validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-6926?
CVE-2015-6926 is a high-severity authentication bypass vulnerability in n/a, published on 19 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.
Weakness: CWE-287
Which versions are affected by CVE-2015-6926?
2 open source packages ship an affected version, including oxid-esales/oxideshop-ce. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
oxid-esales/oxideshop-ce Packagist | All versions | 4.5.0 |
oxid-esales/oxideshop-ce Packagist | All versions | 4.5.0 |
Products include Oxid-Esales Eshop.
How do I fix CVE-2015-6926?
Upgrade oxid-esales/oxideshop-ce to 4.5.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-6926 being exploited?
There is no known exploitation of CVE-2015-6926 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4c39-hj99-5h2r.